summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorDaniel J Walsh <dwalsh@redhat.com>2020-12-09 14:13:53 -0500
committerDaniel J Walsh <dwalsh@redhat.com>2020-12-09 14:21:16 -0500
commit1ace9e3ba618bc21ea41957f1bc60509b56a0a95 (patch)
tree81bbeb66be96499e9689c428dd5212d167280be2
parent9abbe0728c5050914168a154622087a4dacd4dfe (diff)
downloadpodman-1ace9e3ba618bc21ea41957f1bc60509b56a0a95.tar.gz
podman-1ace9e3ba618bc21ea41957f1bc60509b56a0a95.tar.bz2
podman-1ace9e3ba618bc21ea41957f1bc60509b56a0a95.zip
Properly handle --cap-add all when running with a --user flag
Handle the ALL Flag when running with an account as a user. Currently we throw an error when the user specifies podman run --user bin --cap-add all fedora echo hello Signed-off-by: Daniel J Walsh <dwalsh@redhat.com>
-rw-r--r--pkg/specgen/generate/security.go2
-rw-r--r--test/e2e/run_privileged_test.go12
2 files changed, 13 insertions, 1 deletions
diff --git a/pkg/specgen/generate/security.go b/pkg/specgen/generate/security.go
index dee140282..56947ff24 100644
--- a/pkg/specgen/generate/security.go
+++ b/pkg/specgen/generate/security.go
@@ -141,7 +141,7 @@ func securityConfigureGenerator(s *specgen.SpecGenerator, g *generate.Generator,
configSpec.Process.Capabilities.Effective = caplist
configSpec.Process.Capabilities.Permitted = caplist
} else {
- userCaps, err := capabilities.NormalizeCapabilities(s.CapAdd)
+ userCaps, err := capabilities.MergeCapabilities(nil, s.CapAdd, nil)
if err != nil {
return errors.Wrapf(err, "capabilities requested by user are not valid: %q", strings.Join(s.CapAdd, ","))
}
diff --git a/test/e2e/run_privileged_test.go b/test/e2e/run_privileged_test.go
index ab11128ba..760de55b6 100644
--- a/test/e2e/run_privileged_test.go
+++ b/test/e2e/run_privileged_test.go
@@ -90,6 +90,18 @@ var _ = Describe("Podman privileged container tests", func() {
containerCapMatchesHost(session.OutputToString(), host_cap.OutputToString())
})
+ It("podman cap-add CapEff with --user", func() {
+ // Get caps of current process
+ host_cap := SystemExec("awk", []string{"/^CapEff/ { print $2 }", "/proc/self/status"})
+ Expect(host_cap.ExitCode()).To(Equal(0))
+
+ session := podmanTest.Podman([]string{"run", "--user=bin", "--cap-add", "all", "busybox", "awk", "/^CapEff/ { print $2 }", "/proc/self/status"})
+ session.WaitWithDefaultTimeout()
+ Expect(session.ExitCode()).To(Equal(0))
+
+ containerCapMatchesHost(session.OutputToString(), host_cap.OutputToString())
+ })
+
It("podman cap-drop CapEff", func() {
session := podmanTest.Podman([]string{"run", "--cap-drop", "all", "busybox", "grep", "CapEff", "/proc/self/status"})
session.WaitWithDefaultTimeout()